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Amendments to the Claims 

1 . (Currently Amended) A static data flow analysis method comprising: 
receiving a start state from a user; 

chasing a data flow instance of the start state through a first data flow graph local to a 
first procedure until a procedure transition instruction is encountered; 

resolving the transition instruction to a second procedure pointed to by a call graph; and 
chasing the data flow instance into a data flow graph ef local to the second procedure. 

2. (Currently Amended) The method of claim 1 , further comprising: 
encountering a pointer dereference operand while chasing through a the first data flow 

graph; 

chasing backward to resolve where the pointer points; and 

continuing chasing the data flow instance from the resolved pointer dereference operand. 

3. (Original) The method of claim 1 wherein the procedure transition instruction is a 
call instruction, and the data flow instance chase is a forward chase. 

4. (Currently Amended) The method of claim 1 wherein the procedure transition 
instruction is a first instruction of a the second procedure, and the data flow instance chase is a 
backward chase. 

5. (Currently Amended) The method of claim 1 wherein the data flow graphs 
contain comprise pointers to an internal representation of a program. 

6. (Original) The method of claim 5 wherein the internal representation comprises a 
graph data structure. 

7. (Currently Amended) The method of claim 1 wherein the call graph contains 
comprises pointers to an internal representation of a program. 
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8. (Original) The method of claim 2 wherein the resolved pointer dereference is a 
global type, and chasing continues at plural instructions that reference the global as operands. 

9. (Original) The method of claim 2 wherein the resolved pointer dereference is a 
field reference type, and chasing continues at plural instructions that reference the field reference 
as operands. 

10. (Original) The method of claim 1, wherein a state machine directs data flow 
chase through alternating states comprising instruction change states and data transformation 
states. 

1 1 . (Currently Amended ) The method of claim 1 wherein the data flow graph of the 
second procedure is built after the transition is resolved to the procedure. 

12. (Currently Amended) The method of claim 1 wherein the inputs to the method 
comprise binary code, and a the start state comprises a data instance and an instruction address in 
the binary code. 

13. (Currently Amended) A method comprising: 
receiving binary code and a start state; 

creating from binary code a procedures and instructions representation; 
creating a call graph comprising pointers to procedures in the procedures and instructions 
representation; 

creating a data flow graph for a procedure containing comprising the start state, the data 
flow graph comprising pointers to instructions in the procedures and instructions representation; 

chasing a data instance of the start state through instructions in the data flow graph 
corresponding to states in a state machine; and 

upon encountering a procedure transition instruction in the data flow graph, 
corresponding to a state in the state machine representing the call graph, transitioning the data 
instance chase to a data flow graph of a procedure identifiable in the call graph. 



Page 3 of 13 



SAW:vjs 11/14/07 740984 303994.01 
PATENT 



Attorney Reference Number 3382-64713-01 
Application Number 10/609,188 



14. (Original) The method of claim 13 further comprising: 

upon encountering a pointer dereference in an instruction in a data flow graph 
corresponding to a state in the state machine representing a pointer dereference table, performing 
a backward recursive search indicated in the pointer dereference table according to the 
addressing mode of the pointer dereference, and identifying a location in the backward recursive 
search. 

15. (Original) The method of claim 14 wherein the location indicates a field 
reference definition, and the data instance chase resumes at an instruction indicated by a field 
reference list. 

16. (Original) The method of claim 14 wherein the location indicates a global 
reference definition, and the data instance chase resumes at an instruction indicated by a global 
reference list. 

17. (Original) A computer readable medium comprising instructions for performing 
the method of claim 13. 

18. (Currently Amended) A computer readable medium having instructions for 
performing a method comprising: 

receiving a start state from a user; 

chasing a data flow instance of the start state through a first data flow graph local to a 
first procedure until a procedure transition instruction is encountered; 

resolving the transition instruction to a second procedure pointed to by a call graph; and 
chasing the data flow instance into a data flow graph ef local to the second procedure. 

19. (Original) The computer readable medium of claim 18 further comprising: 
encountering a pointer dereference operand while chasing through a data flow graph; 
chasing backward to resolve where the pointer points; and 

continuing chasing the data flow instance from the resolved pointer dereference operand. 
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20. (Original) The computer readable medium of claim 18 further comprising: 

the procedure transition instruction is a call instruction, and the data flow instance chase 
is a forward chase. 

21. (Currently Amended) A computer-based service comprising: 
means for creating an internal representation of a program; 

means for creating a data flow graph for procedures in the internal representation 
comprising pointers to instructions in the internal representation; 

means for creating a call graph comprising pointers to the procedures in the internal 
representation ; and 

means for creating a field reference list comprising pointers to field references in the 
internal representation; 

means for receiving a start state from a user; 

means for chasing a data flow instance of the start state through the data flow graph until 
a procedure transition instruction is encountered; and 

means for resolving the procedure transition instruction to a second procedure pointed to 
by the call graph . 

22. (Original) The computer-based service of claim 2 1 wherein the internal 
representation is a list data structure. 

23. (Original) The computer-based service of claim 21 wherein the internal 
representation is a tree data structure. 

24. (Original) The computer-based service of claim 21 wherein the internal 
representation is a graph data structure. 

25. (Original) The computer-based service of claim 21 wherein the data flow graph 
edges are bidirectional. 



26. (Original) The computer-based service of claim 21 wherein the call graph edges 
are bidirectional. 
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27. (Currently Amended) A computer system including a processor and memory, the 
memory comprising: 

a component for receiving binary files and creating internal representations; 

a component for accessing internal representations and creating a call data structure; 

a component for accessing internal representations and creating a-data flow data 
structure s associated with procedures of the internal representation , and 

a component for accessing internal representations and creating a global reference data 
structure; 

a component for receiving a start state from a user; 

a component for chasing a data flow instance of the start state through one of the data 
flow data structures until a procedure transition instruction is encountered; 

a component for resolving the procedure transition instruction to a second procedure 
pointed to by the call data structure; and 

a component for chasing the data flow instance into the data flow data structure 
associated with the second procedure . 

28. (Original) The computer system of claim 27 wherein the memory further 
comprises a component for accessing internal representations and creating a field reference data 
structure. 

29. (Original) The computer system of claim 27 wherein the call data structure and 
the data flow data structures are graph data structures. 

30. (Original) The computer system of claim 28 wherein the global reference data 
structure and the field reference data structure are list data structures. 
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